A board needs to know whether the authentication programme reduces material business risk and where management still needs to act. A domain policy value and a portfolio pass percentage are useful inputs, but neither describes the whole control. Ask management to connect configuration, observed operation, exceptions and remaining threats to named services.
Ask what is in scope
Request a current inventory covering production senders, critical low-volume workflows, subsidiaries, dormant domains and recently acquired assets as applicable. The scope must be explicit enough to reveal omissions. A metric covering only domains already enrolled in a monitoring platform can hide the unenrolled estate.
Suppose a board’s hypothetical report covers four registered services, with three having current approved aligned-pass evidence. Two are critical, but only one of those two has evidence. The useful summary is 3/4 service coverage and 1/2 critical-service coverage, with the critical gap named. Newsletter volume cannot compensate for that missing evidence. These are assumed values, not a supplied control pack or actual management report.
Ask what the evidence means
RFC 9989 defines DMARC policy and alignment, while RFC 9990 defines aggregate reporting. These provide technical evidence, not a guarantee that all legitimate mail was observed or that all fraud was prevented. Ask which receiving organizations report, which time periods are missing and what separate evidence covers essential business routes.
Distinguish deployed configuration from tested operation. “A reject policy exists” is different from “all approved routes have been verified under that policy.” Neither establishes that a malicious request from a compromised account or lookalike domain will be stopped. Require a short statement of those remaining threats and their separate controls.
Ask which decisions remain open
For the hypothetical critical gap, ask management to name the service owner, the missing observation, the next authorized test and the decision date. For lookalike invoice fraud, ask separately about business verification using an already trusted contact route; a stronger policy on the organization’s own domain does not close that risk. Neither answer should be inferred from a single portfolio percentage.
Now suppose discovery adds a fifth in-scope service with no current test. Coverage falls from 3/4 (75%) to 3/5 (60%) without any previously verified service losing evidence. That decline reflects a broader known population, not necessarily degraded operation. These are hand-worked hypothetical figures. No board decision, management approval or remediation is asserted.
Require accountable follow-through
Ask who owns each material gap, what evidence will close it, when the next decision is due and what happens if that date is missed. Management should explain whether delay requires added staffing, provider cooperation, application changes or explicit risk acceptance. A renewed exception should preserve its original opening date and reason.
Keep the board summary compact while retaining a reproducible evidence pack for assurance reviewers. Report trend changes with their cause: newly discovered services, corrected failures and changed scope are not equivalent improvements. Do not call the programme universally compliant or complete because a technical milestone was reached. The useful conclusion is which material services are covered, which are not yet demonstrated and which decisions management is making next.